PwC Write up Central Affrica Republic

Đề:
WE talk to each other in own way
https://drive.google.com/open?id=0B7ahcQCpMll-ZnNvcDU1RnFKNFU


Ta nhận được 1 file pcap, ta sẽ tiến hành phân tích sơ bộ

:v Mình nhận ra ngay  cái query ffd8ff.g00gle.com có vấn đề
và ffd8ff là 3 bytes đầu của file ảnh JPG, tiếp theo sẽ là e0 và 2 số random và 4a4649
Vậy giờ việc của ta là extract các cái bytes.g00gle.com ấy ra và ghép lại thành bức ảnh thôi
Mình sẽ dùng command extract data query:

tshark -r 5c7d7800965f7012b2adde87fc479d62.pcap -T fields -e ip.src -e dns.qry.name -Y "dns.flags.response eq 0 and dns.qry.name contains g00gle.com" >  flag.txt


Sau đó bỏ vào notepad phẫu thuật tí , và tiến hành ghi file ta được nhận được file ảnh , strings ta nhận được 1 chuỗi hex -> decode ra flag






























Nhận xét

Đăng nhận xét

Bài đăng phổ biến từ blog này

SECT CTF - ACID BURN ft REPORT Misc 200 & 200 Write up

Hình ảnh
Report - Misc ( 200 + 0 ) Mr. Belford sucks, is he hiding something.... Download:  http://dl.ctf.rocks/Report.tar.gz We are given a PDF file, at first i though maybe they hide some image or hidden text inside the pdf, so i use this site to extract   But wow, the are neither image nor font ,  nothing but text and metadata, cool  :D  So i was googling to see if the anyway to hide data in PDF We know that hidden data can be embeded in  But in SHA2017 CTF, i have solved something encrypted with AES , to recover, we must know how the PDF Structure to get key, so i think maybe the data is embeded in the OBJ section like  and below is the hidden data that we need to find.  So I used binwalk to extract data in pdf file ( fore some reason i cant use any pdf tool in my ubuntu, still working on fixing lol ) , then check the obj section ( in .zlib ) as u can see, we know that the prefix "SECT" in hex are : 53 45 43 5...
Đọc thêm

SHACTF 2017 Write up for MISC Junior (200)

Hình ảnh
Crypt1:All about the base   V2VsbCBkb25lLAoKdGhpcyBmaWxlIGlzIGVuY3J5cHRlZCB3aXRoIEJhc2U2NC4gT2Z0ZW4gdXNl ZCBpbiBDVEYncyB0byBkaXNwbGF5IGJpbmFyeSBkYXRhIGluIGEgbW9yZSBmcmllbmRseSB3YXku IAoKVGhlIGZsYWcgZm9yIHRoaXMgY2hhbGxlbmdlIGlzIGZsYWd7YjNlOWMzZWVlNjA5YmFjNDZm YWQ0NDM5Y2YzMjFmZTV9Cg== just base64 decode -> flag Crypt 1: Rotation Seems someone rotated the alphabet, can you get the original message back? Ykksy eua ckxk ghrk zu mkz znk zkdz hgiq. Znk lrgm oy lrgm{30j3g1gg0ijg9l08ijlg52668hi6854g} Okay, must be caesar right? i took the part " lrgm{30j3g1gg0ijg9l08ijlg52668hi6854g}" Because i know for sure lrgm must be flag in some ROT    kt.pe is dead :v so i wrote a script to do the job :v    flag: flag{30d3a1aa0cda9f08cdfa52668bc6854a} Crypt2: Substitute Teacher Hello, my name is Mr. Smith, I will be your  substitute  teacher for today. I only have one assignment for you today, if you solve it you may go home. Now be silen...
Đọc thêm

Write up - SHACTF 2017 ( 2For100 + Cryp100 + Network100 + Crypt200)

Hình ảnh
1. Crypt100 : Stackoverflow I had some issues implementing strong encryption, luckily I was able to find a nice example on  stackoverflow  that showed me how to do it. Challenge:  stackoverflow.tgz File contains: - Script At first, when we check the given site above, we know that this pdf was encrypted with AES-CTR mode, and more interesting, we can see that they reuse the Counter -> that make AES-CTR vulnarable to Known-Plaintext attack crypto = AES.new(os.urandom(32), AES.MODE_CTR, counter=lambda: secret) with secret = os.urandom(16) Okay, let take look at the AES-CTR , let see the reason why they are vulnerable to Known-Plaintext attack: 107.50 KB Normally Counter must be UNIQUE , so that the keystream will be different every step. It is more secured than reused , it will make AES-CTR encryption become:  E(m[i]) = message[i] ^ keystream = cipher[i] and when we know the plaintext message[i] and the cipher[i] , we will get t...
Đọc thêm